← Rules Catalog
lowkernelverified rollback-safe

Disable hfsplus kernel module

kmod-disable-hfsplus · RHEL ≥ 8, UBUNTU ≥ 22 · 1 impl

Description

The hfsplus filesystem type is the Apple Mac OS Extended filesystem, rarely needed on Linux and an unnecessary kernel attack surface.

Rationale

Removing support for unneeded filesystem types reduces the local attack surface. If this filesystem type is not needed, it should not be loadable.

Check → Remediate

Checkkernel_module_state
name:
hfsplus
state:
blacklisted
Remediatekernel_module_disable
name:
hfsplus

Framework references

CIS

rhel8 1.1.1.4rhel9 1.1.1.4rhel10 1.1.1.4ubuntu22 1.1.1.4ubuntu24 1.1.1.4

NIST 800-53

CM-7

Live verification

rhel10:checkrhel8:checkrhel9:checkubuntu22:checkubuntu24:check
#kernel-module#attack-surface#cis